We upgraded early last week from 9.1.

My scans now indicate 3 different Adobe patches as well as Firefox for every client scanned, no matter what.  If the software isn't there, it will INSTALL IT!

None of these items are in the Patch Group that I use to specify patches, but they show up anyway.  I do not have Software Deployment enabled and do not ever use it.

We currently cannot use our Shavlik environment.  I've opened a couple cases and we are awaiting the update due this week.  Is anyone else having issues like this?

Hi,

I have updated the Java on Windows but it does not seem to update the Java plug in in Internet Explorer. How can i update the plugin?

Thanks,

Asif

Purpose

When running the Shavlik Protect in a secure environment without Internet access, it is necessary to download the latest data files on a system that has internet access and then transfer them to the console machine.

This article applies only to patch data.

Description

This article discusses both methods:

• PowerShell (Highly Recommended)
• Individual file download (All Files Are Required)

PowerShell

  Running the script on a Windows 7 SP1 system with the natively installed PowerShell does not work with the execution policy set to "RemoteSigned". You will still receive an error that the script is not digitally signed. The script will only run if the execution policy is set to "unrestricted"

To use the PowerShell script:

• Download and install PowerShell 1.0 from Microsoft, if it is not already installed. For more information, see Microsoft KB article 926140.
• Shavlik NetChk Protect and VMware vCenter Protect patch files are released twice per week. To download the patch files, you can use a PowerShell script to automate the process or you can download each file individually.
• If you need a compression utility, download and install the 7-Zip extraction utility from http://www.7-zip.org/download.html.

          Shavlik does not endorse or recommend any particular third_party utility.

• Create an output directory.
• Download and extract the PowerShell script attached to this article: DownloadProtectData90.zip

  This script works for all versions of these products.

• Open a command prompt.
• Enter PowerShell by typing powershell.
• Navigate to the location where you extracted the PowerShell script.
• At the PowerShell command prompt, launch the script with this command:
  
  .\DownloadProtectData90.ps1 "<outputdirectory>" <major or minor version> "<7-zip directory>"
  
    The command begins with the characters . before the script name. These characters are required if the script is in the current working directory. If you are in a different directory, enter the full path to the script.
  
  The major/minor version argument has a two-digit value. Use the value corresponding to your version:

• Protect 9.0: 90
• Protect 9.1: 91
• Protect 9.2: 92

Example:

The command you run looks like this: .\DownloadProtectData90.ps1 "C:\Data" 90 "C:\program Files\7-Zip"

The command has these elements:

• .\DownloadProtectData.ps1: This is the script itself.
• c:\Data: This is the folder to which you are downloading the data files.
• 90: This is the version of vCenter Protect or Shavlik Protect files you are downloading.

1. You may see this error:
   
   execution of scripts is disabled on this system
   
   If this occurs, enable the execution of scripts by entering this command:
   
   set-executionpolicy RemoteSigned

  This command is case-sensitive.
   
   Alternatively, you can sign the script instead of changing the execution policy. For more information, see http://www.hanselman.com/blog/SigningPowerShellScripts.aspx.    The preceding link was correct and last checked as of June 11, 2013.

Individual file download

You can manually download the necessary data files. To download the files:

1. Right-click each link and select Save Link As.
2. Save the files to the console, in the DataFiles folder. This is the default location:
   • 8.x on Vista, 2008, & Windows 7: C:ProgramData\Shavlik Technologies\NetChk\DataFiles
   • 8.x on Windows XP or 2003: C:\Documents and Settings\All Users\Application Data\Shavlik Technologies\NetChk\DataFiles
   • 9.x on Vista, 2008, & Windows 7: C:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles
   • 9.x on Windows XP or 2003: C:Documents and SettingsAll UsersApplication Data\LANDesk\Shavlik Protect\Console\DataFiles

  The Protect console requires both the .CAB and the files archived within the .CAB files for Protect to function correctly. The PowerShell script downloads the .CAB files, places the files in the output directory, and extract the files to the output directory. You need to manually extract the .CAB files using an archiving tool like 7-Zip if you choose to manually download the .CAB files.

Update files for Shavlik Protect 9.0:

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STPlatformUpdater.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/AssetInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/PatchInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ThreatInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/cl5.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ST.Licensing.Data.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/DplyEvts.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/7z.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot64.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STSchedEx.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STRemoteCommand.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STScheduleView.exe

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/assetinventory.xml

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STPlatformUpdater.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/cl5.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ST.Licensing.Data.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/DplyEvts.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/7z.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot64.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STSchedEx.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STRemoteCommand.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STScheduleView.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/hypervisors.cab

http://xml.shavlik.com/data/assetinventory.cab

http://xml.shavlik.com/data/Protect/v9/90/manifest/protect.manifest.cab

Update files for Shavlik Protect 9.1.4334:

http://xml.shavlik.com/data/protect/v9/91/protect/4334/7z.dll

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4334/cl5.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot64.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stschedex.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stremotecommand.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stscheduleview.exe

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4334/assetinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/patchinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/threatinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/st.licensing.data.dll

http://xml.shavlik.com/data/protect/v9/91/protect/4334/dplyevts.dll

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/supportedHypervisors.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stplatformupdater.exe

http://xml.shavlik.com/data/assetCatalog2.obf

http://xml.shavlik.com/data/assetCatalogMetadata2.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4334/7z.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/cl5.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot64.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stschedex.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stremotecommand.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stscheduleview.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/st.licensing.data.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/dplyevts.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/supportedHypervisors.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stplatformupdater.cab

http://xml.shavlik.com/data/assetCatalog2.cab

http://xml.shavlik.com/data/assetCatalogMetadata2.cab

http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab

Update files for Shavlik Protect 9.1.4511:

http://xml.shavlik.com/data/protect/v9/91/protect/4446/7z.dll

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/protect/v9/91/protect/1048/cl5.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot64.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stschedex.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stremotecommand.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stscheduleview.exe

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4446/assetinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4446/patchinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4446/threatinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4446/st.licensing.data.dll

http://xml.shavlik.com/data/protect/v9/91/protect/4446/dplyevts.dll

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/supportedHypervisors.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stplatformupdater.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stplatformupdater.exe

http://xml.shavlik.com/data/assetCatalog2.obf

http://xml.shavlik.com/data/assetCatalogMetadata2.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4446/7z.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/protect/v9/91/protect/1048/cl5.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot64.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stschedex.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stremotecommand.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stscheduleview.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/st.licensing.data.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/dplyevts.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/supportedHypervisors.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stplatformupdater.cab

http://xml.shavlik.com/data/assetCatalog2.cab

http://xml.shavlik.com/data/assetCatalogMetadata2.cab

http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab

Additional Information

Shavlik Protect and VMware vCenter Protect consoles that have no internet connectivity, but that still try to download updates automatically can experience other issues. Shavlik recommends setting consoles with no internet connectivity to Disconnected Mode. To enable Disconnected Mode from the console application:

Version 8.x: Go to Tools and select Run Disconnected.

Version 9.x: Go to Tools and deselect Auto-Update Definitions.

Document Content Update History

11/1/2011 - Updated article for VMware vCenter Protect 8.0.x 

07/16/2013 - Updated article for Shavlik Protect 9.0.x

05/21/2014 - Updated article for Shavlik Protect 9.1.x

Products

Shavlik Protect 9.x

We are running in an issue where our Shavlik Servers are unable to deploy these three patches MS15-106, MS15-109, MS15-111 on any Server. If we install the Patches manually, installation is successful. Deployment of these three patches is NOT happening automatically on any of the Server in our environment.

Error: File not downloaded: Windows6.1-KB3080446-x64.msu

Error reason: Unable to connect to the remote server: https://download.microsoft.com/download/B/7/2/B72127C1-C437-4FB9-9988-61DE252EF9D7/Windows6.1-KB3080446-x64.msu

Error: File not downloaded: Windows6.1-KB3093983-x64.msu

Error reason: Unable to connect to the remote server: https://download.microsoft.com/download/F/2/C/F2CA62C8-774A-404F-BC21-1931546A6B2C/Windows6.1-KB3093983-x64.msu

Error: File not downloaded: Windows6.1-KB3088195-x64.msu

Error reason: Unable to connect to the remote server: https://download.microsoft.com/download/8/1/4/814EB11C-4FAF-4DF8-96D0-E7B987D84952/Windows6.1-KB3088195-x64.msu

Error: File not downloaded: Wireshark-win64-1.12.8.exe

Error reason: The request was aborted: The request was canceled.: https://www.wireshark.org/download/win64/all-versions/Wireshark-win64-1.12.8.exe

Zero patches are available and properly signed.

No patches were deployed. Please review the program logs to determine the cause.

Patch deployment canceled due to failure building deployment instructions. @

So, in 9.1x, when you created a custom action, you could push a file, and it would go to   %pathtofixes%Install\....

Then you could call that file using %PATHTOFIXES%Install\myFile.exe

In 9.2, there ISN'T a  "%pathtofixes%Install"  directory

There's a  "%pathtofixes%Installation\InstallationSandbox#<datetime>" directory that will be different for every deployment...

Help file and documents posted here: http://rs.shavlik.com/documents/Shavlik_Protect_92/ag-prt-9-2.pdf   all have incorrect info.

How do I call an exe that I push?

Ken

Silly me. I don't recall how to view scan results for comparison, I've done this in the past. For example, I run a security scan on a group using a security scan template and would later on run a WUscan for comparison. I was able to view this as the same time instead of view results one at a time. Do you recall when this option is from the menu bar?

TIA

Hi all,

As of 9.1 and below i was told there was no api that could connect to shavlik to kick off scans, for example, after a new build and during automation. Is this still the case in 9.2 or has any type of automation been included in this release?

thanks

Hi, has the search functionality in 9.2 changed at all? In versions 9.1 and below, when you would search for a machine, it would only tell you the machine group it was in from the last scan. If a machine was in 3 different groups, there was no way to find this out. Has that changed at all in 9.2?

Thanks

Hey All

Quick question, is it possible to run a powershell script before patching a server, and then after the patch has completed, run another powershell script?  Also, I assume that you could use the machine variables when running this patch.

Essentially, what I'd like to accomplish:

1. Set a web application logically offline in a sql server database via the Invoke-SqlCmd (or rig up a web request to set a machine logically offline, if need be...)
2. Patch the server
3. Set the web application back online via the invoke-sqlcmd again

This is probably really easy, I'm just really really unfamiliar with shavlik.

Thanks!

Overview

(All of this information (and more) is located in theProtect 9.2 Upgrade Guide. We highly recommend all customers review the changes detailed in this guide.)

The purpose of this document is to inform our customer base of major Scan Template and Patch Group changes after upgrading to Protect 9.2.4988 release 11/5/2015.

There are three issues/changes to consider in these areas:

• Patch Scan Templates: The Filtering tab on the Patch Scan Template dialog has been updated to allow for more precision when scanning. While the upgrade process will automatically convert your existing patch scan templates to the new style, you should double-check your templates to verify the changes.
• Patch Groups: Patch groups are no longer defined using a separate dialog; rather, they are now created and managed from within Patch View. While the upgrade process will automatically convert your existing patch groups to the new convention, you should double-check your groups to verify the changes. Your patch groups may be smaller.
• Modified and Auto-Generated Patch Groups: In order to preserve the behavior of your patch scan templates, one or more of your existing patch groups may be modified during the upgrade process and one or more new patch groups may be automatically generated.
  • Modified Patch Groups: If you reference a patch group within the Patch filter settings section of your 9.0 or 9.1 patch scan template and Scan selected is enabled, any patches that do not meet the criteria defined by the scan template filters will be removed from the group. Here’s why: In Protect 9.0 and 9.1, the scan template filters can mask the fact that your patch group may contain patch types that you never intended to actually scan for or deploy. In Protect 9.2, when the patch group is used as a baseline, the scan template filters will not be applied and inaccuracies in your patch groups may be revealed. If the upgrade process detects this situation, it will automatically modify the patch group in order to preserve the intended interaction between the scan template and the patch group.

Example: Assume your 9.1 patch group contains a mix of Security, Non-security and Software Distribution patches. In the scan template that references this patch group, the Patch filter settings section is set to Scan selected and the Patch Properties section is set to detect only Security patches. In this configuration, the Patch Properties filter will be honored and only Security patches will be detected (despite the fact that the patch group contains Non-security and Software Distribution patches).

After upgrading to 9.2, the scan template will define the patch group as a Baseline filter and all other scan template filters will be ignored. If the patch group is not modified, Non-security and Software Distribution patches will now be detected (and deployed, if you enable the Auto-deploy patches after scan check box when performing a scan). The upgrade process will recognize this discrepancy and will remove the Non-security and Software Distribution patches from the patch group.

Going forward, be careful to properly manage your patch groups by not adding unnecessary or unwanted patches or patch types.  This is especially important when adding Software Distribution type patches into the Patch Group.  This will deploy products to the target machines.

• Auto-Generated Patch Groups: A copy of an existing patch group will be automatically generated by the upgrade process if all of the following conditions are met:
  • If the patch group is referenced within the Patch filter settings section of a patch scan template and Scan selected is enabled, and
  • If the patch group is referenced by an agent policy or by a second scan template that contains different filter definitions, and
  • If the patch group must be modified by the upgrade process to maintain compatibility (see above)

In this situation, a copy of the patch group will be generated and then modified as described above. The name of the new patch group will be *<patch group name> -generated for <scan template name>. The scan template(s) that reference the patch group will be updated to use the new patch group name. The original patch group is preserved so that references to it from your agent policies or other scan templates are maintained.

You should review the changes and, if desired, rename the auto-generated patch group to a more friendly or meaningful name.

Affected Product(s)

Protect 9.2.x

Anyone else getting this, if they do will the update fix this issue i am having?

Error message that comes on during loading

c windows/system32/echo off

system error 1378 occurred

Specific account is already in use

Did a test without the patch shavlik released, success

Question now is if there is an update to this issue i am having.?

Thank you to anyone that can help

Hi,

we are using BladeLogic to patch our Windows Servers.

We have been made aware that our servers miss KB3097966.

We checked our Patch-Catalogs and such a Hotfix is not in place, also non of the Shavlik XML Updates seems to reference that KB.

Can somebody enlighten me, why this is the case ?

Steffen

The new interface seems nice, but how in the heck do you add new patches to patch groups?

I copied a patch group from last month.

I opened it like I used to.

I now see the new interface but there is no browse or add button to add new patches and I don't even see any newer patches in the interface.

What am I missing?

After Patching my first group of servers with Shavlik, I've noticed that the C:\Windows\Temp folder is filling up Cab_xxxx_x.cab files. These file are created every 30 minutes. I did some googling and a lot of people are seeing it on Windows 2008 R2 server. They are also saying that it might be related to the C:\Windows\Logs\CBS CbsPersist files.

The only machines it is happening on are ones that were patched with Shavlik and the first issues starting show up after the machines were patched.

Windows update on these machines is set to check and notify but not download. most of these machines were reporting that they needed windows updates before they were patched with Shavlik. After the patching Windows update is still reporting this. Normally to remove that message, I stop the Windows update service and delete the C:\Windows\Softwaredistribution folder but that doesn't resolve the problem with C:\windows\temp being created.

Thoughts?

Hi,

I am trying to script a post installation process, which includes running our monthly patch feature in Shavlik Protect Agent 9.1.

Can I run this in a BAT-file?

Thanks in advance.

Looking to try to schedule a weekly software catalog report so we can use it to compare what changed.  I like the layout of this report compared to the machine software detail report I can check to get it emailed to me when I run scans against a group.  Any ideas?

Hello and Good Evening Shavlik Community....

I updated two of my four 9.1 consoles to version 9.2. I have been doing some poking around and I noticed that the UI\location for testing existence and credentials for a machine has changed a bit. It says in the release notes for 9.2, that this functionality has been combined into a single function that now is completed by doing a Power Status. I noticed that when I right click on a machine now and select the option for Test existence/credentials, it seems to test the existence just fine, but I don't think its checking credentials. I have tested this my assigning a machine a credential I KNOW should not work, and the Test Results screen comes back and says everything is fine.

This function worked fine in 9.1, and is important to us because we have computers that are domain joined, and some that are not. And we have many domains. So we need to have this credential check in place and working to make sure things are okay. Did the credential check part get removed accidentally? Can anyone on 9.2 recreate this? I am on the latest build, 9.2.0 Build 4988

Hello all,

Since upgrading my Shavlik Protect servers to version 9.2, my deployments are failing with a "452 Unable to connect to remote machine" error. I verified the credentials, can ping and remote into the servers being patched with those same credentials. I can connect to them and scan them for a report, but not deploy patches. Thanks.

I need clarification on the reboot options in the post deploy reboot tab of the deployment template.

After patches are deployed, I want to give the users options to delay the reboot.  But if they don't reboot, force the reboot to be at Midnight or something. Can it be configured like this?  If so, will it work if the computer is in sleep or hibernate mode?

Hi Guys

Just finished scanning 300 servers but had to rescan at least 4 time to get a clear 0 patch's missing result

First scan deployed and executed successfully

Second scan MS15-121 required executed successfully

Third scan MS15-115 required executed successfully

Fourth scan all clear

Has anyone else got the same issue.

The other thing was it was taking about an hour after the reboot to report back that it was successful every time.

Thanks

Steve Mills

Information Strategy and Technology Services

University of South Australia

e: steve.mills@unisa.edu.au